feat: enable HTTPS, OIDC auth, Collabora, ClamAV, and OPA policies

[suse-coder]

Summary

This PR enables a production-ready HTTPS deployment with OIDC authentication, document collaboration, virus scanning, and security policies.

Key Changes

🔐 HTTPS & TLS

• Enable TLS termination via cilium-gateway
• Configure all services with HTTPS URLs
• Add HTTP→HTTPS redirect HTTPRoutes for all services
• Update CSP to use HTTPS URLs
• Fix config.json to use HTTPS scheme

🔑 OIDC Authentication (Keycloak)

• Configure Keycloak OIDC with proper redirect URIs
• Add all required scopes (openid, profile, email, groups, roles)
• Fix roles mapper to use flat claim name
• Deploy Keycloak HTTPRoutes in keycloak namespace
• Enable KC_PROXY=edge for proper HTTPS handling

📄 Document Collaboration (Collabora)

• Enable Collabora with proper WOPI configuration
• Fix jail security warnings:
  • Add child_root_path and cache_files.path configuration
  • Set security.capabilities=false
  • Configure proper securityContext (runAsNonRoot, drop ALL capabilities)
  • Add emptyDir volumes for coolwsd-child-roots and coolwsd-cache
• Add HTTPRoute with proper section names matching gateway listeners

🦠 Virus Scanning (ClamAV)

• Enable ClamAV virus scanning
• Configure infected file handling (abort on detection)
• Set scanner socket to tcp://clamav.clamav.svc.cluster.local:3310

🛡️ Security Policies (OPA)

• Enable OPA policies for file type restrictions
• Restrict executable file extensions (.exe, .dll, .msi, etc.)
• Restrict dangerous MIME types

🌐 HTTPRoutes & Gateway

• Add HTTP→HTTPS redirect routes for all services
• Use proper section names matching cilium-gateway listeners:
  • opencloud-proxy-http/https
  • opencloud-keycloak-http/https
  • opencloud-collabora-http/https
  • opencloud-wopi-http/https
• Deploy Keycloak routes in keycloak namespace (no cross-namespace refs)

📚 Documentation

• Update README with helmfile sync installation method
• Update NOTES.txt with HTTPS URLs and enabled features
• Update prerequisites for Kubernetes 1.33+ and Gateway API
• Add enabled features checklist

Storage

• Use ceph-cephfs StorageClass with RWX access mode
• Dynamic provisioning for persistent volumes

Testing

• Verified HTTPS access to all services
• Verified OIDC login flow with Keycloak
• Verified Collabora document editing
• Verified ClamAV virus scanning
• Verified OPA policy enforcement
• Verified HTTP→HTTPS redirects

[suse-coder]

Do you know if "{"level":"error","service":"storage-users","host.name":"opencloud-opencloud-6f8488f87b-g47fb","pkg":"rgrpc","driver":"posix","error":"error: not found: record not found in cache","path":"/var/lib/opencloud/storage/metadata/spaces/f1/bdd61a-da7c-49fc-8203-0558109d1b4f/nodes/3b","time":"2026-06-06T20:49:12Z","line":"github.com/opencloud-eu/reva/v2@v2.46.2-0.20260602061404-0e975e5456eb/pkg/storage/fs/posix/tree/assimilation.go:991","message":"could not get ids for path"}
{"level":"error","service":"storage-users","host.name":"opencloud-opencloud-6f8488f87b-g47fb","pkg":"rgrpc","driver":"posix","error":"error: not found: record not found in cache","path":"/var/lib/opencloud/storage/metadata/spaces/f1/bdd61a-da7c-49fc-8203-0558109d1b4f/nodes/78/1a","time":"2026-06-06T20:49:12Z","line":"github.com/opencloud-eu/reva/v2@v2.46.2-0.20260602061404-0e975e5456eb/pkg/storage/fs/posix/tree/assimilation.go:991","message":"could not get ids for path"}
"
in opencode pod

is normal I guess you had that also

[Tim-herbie]

You deploy opencloud and all the stuff with helmfile and not with helm or?

[suse-coder]

You deploy opencloud and all the stuff with helmfile and not with helm or?

Yes for testing I just run the helmfile. For Prod I use timoni (and in the future kind: HelmChart).
I deploy it with timoni (flux-helm-release adapter for helm) with fluxcd.

[suse-coder]

But I think the future is going away from helmfiles -> to yaml based HelmRepositories and HelmCharts (multiple yaml) from https://fluxoperator.dev/docs/charts/flux-operator/

---
apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmChart
metadata:
  name: podinfo
  namespace: default
spec:
  interval: 5m0s
  chart: podinfo
  reconcileStrategy: ChartVersion
  sourceRef:
    kind: HelmRepository
    name: podinfo
  version: '5.*'

I wanted to try it out, yet not had time for it. But it is how to do it right (if one is not using timoni).

# redis-repo.yaml
apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
  name: bitnami
  namespace: default
spec:
  interval: 1h
  url: https://charts.bitnami.com/bitnami
  

[Tim-herbie]

Yeah I use the helmrepository and helmrelease already with e.g.:

apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
  name: opencloud-github
  namespace: flux-system
spec:
  type: oci
  interval: 5m
  url: oci://ghcr.io/tim-herbie/opencloud-helm
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: opencloud
  namespace: opencloud
spec:
  releaseName: opencloud
  interval: 5m
  chart:
    spec:
      chart: opencloud
      sourceRef:
        kind: HelmRepository
        name: opencloud-github
        namespace: flux-system
      version: "2.4.3"
  values:

    global:
      domain:
        oidc: keycloak.demo.de
        opencloud: opencloud.demo.de
        wopi: wopiserver.demo.de
        collabora: collabora.demo.de
        onlyoffice: onlyoffice.demo.de
        companion: companion.demo.de
      
    oidc:
      enabled: false
      external:
        issuerUrl: "https://keycloak.demo.de/realms/master"
        clientId: "web"
        realm: "master"

    postgres:
      enabled: false

    opencloud:
      enabled: true
      replicas: 1
      logLevel: "warn"
      enableBasicAuth: false
      
      persistence:
        config:
          enabled: true
          size: 5Gi
          accessMode: ReadWriteMany
        data:
          enabled: true
          size: 10Gi
          accessMode: ReadWriteMany
       
      resources:
        requests:
          cpu: "250m"
          memory: "512Mi"
        limits:
          cpu: "1000m"
          memory: "2Gi"
      storage:
        s3:
          enabled: false
          external:
            endpoint: "https://s3.de.io.cloud.ovh.net"
            region: "de"
            existingSecret: "opencloud-s3-credentials"
            bucket: "rke2ciliumopencloud"
      env:
        - name: GRAPH_LDAP_SERVER_WRITE_ENABLED
          value: "true"
        - name: "PROXY_OIDC_ACCESS_TOKEN_VERIFY_METHOD"
          value: "none"

    httpRoute:
      enabled: true
      
      gateway:
        name: cilium-gateway-external
        className: cilium
        namespace: "kube-system"
        sectionName: https-demo

I think this is also better than using Timoni. I would prefer to use YAML-based files; however, I'm generally more of a fan of JSON, especially for tools like Terraform.

[Tim-herbie]

FYI: I am on vacation right now . We can discuss a little bit here, but I can´t review such a big pr for the next 1-2 weeks right now.

[suse-coder]

FYI: I am on vacation right now . We can discuss a little bit here, but I can´t review such a big pr for the next 1-2 weeks right now.

good holiday

[suse-coder]

One can test with https://testfile.org/all-pdf-sample-test-file-download-direct/

[Tim-herbie]

@suse-coder I’m open to using a different Tika image.

Looking at this PR, how should we proceed? As discussed, we don’t want to introduce Helmfile or Timoni.

What would be the best next step from your perspective?

[suse-coder]

@Tim-herbie can be merged now. works also with tika. have timoni replaces with bare helmreleases.

[suse-coder]

@Tim-herbie Guess you are still on holiday. But it can be merged if you are ready.